Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

Gheist and GhostAction steal GitHub secrets via Actions

4 sources · 4 articlesFirst reported Updated ()1
What's new

October 28: Wiz detailed private and GitHub Enterprise Server runs, while GitGuardian’s larger public wave was reported as largely failed.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Attackers still plant GitHub Actions workflows on compromised accounts to steal secrets; the latest public wave largely failed.

Wiz Research says a threat actor it calls Gheist plants workflows on compromised GitHub accounts, prints secrets into logs, pulls those logs through GitHub’s API, and deletes the runs within seconds. GitHub’s approval hold blocked the public-repository runs, but Wiz saw successful execution on private repositories and GitHub Enterprise Server, plus a later variant that searches self-hosted runners. GitGuardian says GhostAction pushed security-audit.yml into roughly 30,000 repositories from October 8 to 12, then 72,000 commits to 23,000 public repositories from October 13 to 21. Dark Reading says that later wave has largely failed. Wiz says credentials from one organization were later used to enumerate AWS Secrets Manager.

Key facts
  • Wiz tracked over 13,500 malicious branches on more than 850 accounts since September 15.
  • sync-check workflows encode secrets in base32 so GitHub log masking misses them.
  • About 8,000 of 23,000 later-wave repositories were new targets, GitGuardian says.
  • Teams were told to hunt ci-sync- branches and commits titled ci: sync config.
  • A sync-host job looks for tokens, keys, Docker sockets, and cloud credentials.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Sep 15, 2026Wiz began tracking Gheist malicious branches on GitHub accounts. · CSO Online
  2. Oct 8, 2026GhostAction wave began pushing security-audit.yml into repositories. · Dark Reading
  3. Oct 13, 2026Larger GhostAction push of 72,000 commits started. · Dark Reading

What each outlet adds

beyond the shared facts
  • CSO OnlineWiz’s private-repo and GHES success, base32 masking bypass, and AWS use.
  • Dark ReadingGitGuardian commit totals and that the later public wave largely failed.
Vendors
GitHubRadware
Products
GitHub ActionsGitHub Enterprise ServerAWS Secrets ManagerGitHubTrivyMLflowBraveLangExtract
Threat actors
GheistGhostAction
Victims
Google LangExtractTrivyBrave BrowserMLflowToolJetPX4-Autopilot
Organizations
WizRadwareGitHubGitGuardian

Coverage

oldest first · one row per article · UTC
  1. · 6d ago CSO OnlineFirst report

    Gheist harvests secrets through malicious GitHub Actions workflows

    Wiz tracked more than 13,500 malicious branches on over 850 accounts since September 15, including private enterprise repositories.

  2. · 6d ago Dark Reading

    GhostAction GitHub campaign slows after hitting tens of thousands of repos

    GitGuardian says the operator pushed 72,000 commits to 23,000 public repositories from October 13 to 21.

  3. · 5d ago The Register · Security

    GitHub issues used in CI attacks on 61 public repositories

    Radware counted 83 payloads, mostly within 43 minutes on September 1, aimed at stealing CI secrets; code changes remain unconfirmed.

  4. · 2d ago Cyber Security News

    Hackers target 61 GitHub repos with command injection

    Coordinated attack on 61 repositories used command injection in GitHub Actions to steal CI/CD secrets; 83 malicious issues and PRs identified.